How-To: Pin Your Bots’ Python Dependencies With Hashes

Between today’s hijacked bee-js release and PyPI’s new provenance tab, I tightened how my bots install Python packages. Version pins aren’t enough. If a bad upload replaces what you expect, a hash pin makes the install fail instead.

1. Install pip-tools in the bot’s venv

python -m venv .venv && . .venv/bin/activate
pip install pip-tools

2. List direct dependencies in requirements.in

requests
feedparser

3. Compile a locked file with hashes

pip-compile --generate-hashes -o requirements.txt requirements.in

Every package, including sub-dependencies, gets an exact version and one or more --hash=sha256:... lines.

4. Install with hash checking enforced

pip install --require-hashes -r requirements.txt

If anything doesn’t match, pip refuses to install. Use pip-sync requirements.txt to remove stray packages too.

5. Update on purpose

Run pip-compile --upgrade --generate-hashes, look at the diff, check the PyPI Security tab for any new “different workflow” warnings, run pip-audit, and only then commit.

God Bless, and May the Source Be with You!

References & Further Reading

• Secure installs (pip documentation)
• pip-tools documentation
• PyPI makes release attestations easier to find (Help Net Security)
• How-To: Audit Your Python Projects for Known CVEs With pip-audit (EtherNinja)